Why DMARC exists
SPF and DKIM each authenticate something — SPF the sending IP, DKIM the message body — but neither enforces alignment with the From: header the user sees. DMARC closes that gap.
A DMARC verdict requires that at least one of SPF or DKIM both pass AND align with the From: domain. If neither aligns, DMARC tells the receiver to apply your published policy: monitor only (p=none), spam-fold (p=quarantine), or reject (p=reject).
What a DMARC record looks like
A single TXT record at _dmarc.<domain>. Required tags: v=DMARC1 and p=.... Strongly recommended: rua= for aggregate reports.
_dmarc.yourdomain.com. TXT "v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain.com; pct=100"The policy ramp: none → quarantine → reject
p=none is monitoring-only. Receivers report on alignment but enforce nothing. Use this for the first 1-2 weeks while you watch RUA reports for unauthenticated traffic you forgot about.
p=quarantine tells receivers to spam-fold mail that fails alignment. The right default once your reports are clean.
p=reject tells receivers to drop the message entirely. The strongest signal — set only after weeks of clean quarantine-tier reports.
Aggregate (RUA) and forensic (RUF) reports
Receivers that honour DMARC send daily aggregate reports (RUA) to the address in your rua= tag. These are XML summaries of pass/fail counts per source IP and authentication result — the primary data source for finding senders you forgot about (third-party tools, dev environments) before you tighten the policy.
Forensic reports (RUF) are per-failure samples — heavier and less universally supported. RUA alone is enough for almost every team.
Alignment: strict vs relaxed
adkim=r / aspf=r (relaxed, the default): the From: domain only needs to share an organisational domain with the signing / SPF domain. mail.yourdomain.com aligns with yourdomain.com.
adkim=s / aspf=s (strict): exact domain match required. Rarely needed; only meaningful when you specifically want to prevent subdomain spoofing.
How SNDR handles DMARC
We recommend p=quarantine as the default once you have run p=none for 1-2 weeks with clean RUA reports. The /tools/dmarc-checker page parses any domain's policy and grades enforcement strength.
Our /tools/dmarc-checker validates the published record, surfaces missing rua= addresses, and flags the most common misconfigurations (subdomain inheritance gaps, missing pct=, mis-spelled tag names).